Merge pull request #1851 from CVEProject/af-1842

Resolves Issue #1842: updateUser UUID correction

Author: jdaigneau5

src/controller/registry-user.controller/registry-user.controller.js

@@ -400,9 +400,8 @@ async function updateUser (req, res, next) {
         }
       }
 
-      // Move lookups of immutable properties BEFORE the transaction mutation writes to completely bypass read-after-write anomalies
       const requestingUserUUID = await userRepo.getUserUUID(req.ctx.user, req.ctx.org, { session })
-      updatedUserUUID = await userRepo.getUserUUID(req.ctx.user, org.UUID, { session })
+      updatedUserUUID = userToEdit.UUID
 
       updatedUser = await userRepo.updateUserFull(userToEdit.UUID, body, { session }, true, requestingUserUUID)
       await session.commitTransaction()
@@ -454,9 +453,9 @@ async function deleteUser (req, res, next) {
       action: 'delete_registry_user',
       change: user.username + ' was successfully deleted.',
       req_UUID: req.ctx.uuid,
-      org_UUID: await orgRepo.getOrgUUID(req.ctx.org)
+      org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
+      user_UUID: user.UUID
     }
-    payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
     logger.info(JSON.stringify(payload))
 
     const responseMessage = {

test/integration-tests/registry-user/registryUserCRUDTest.js

@@ -1,15 +1,125 @@
 const chai = require('chai')
 const expect = chai.expect
 chai.use(require('chai-http'))
+const sinon = require('sinon')
+const { v4: uuidv4 } = require('uuid')
 
 const constants = require('../constants.js')
 const app = require('../../../src/index.js')
+const logger = require('../../../src/middleware/logger')
 
 const secretariatHeaders = { ...constants.headers, 'content-type': 'application/json' }
 
+const getLoggedPayload = (loggerInfoStub, action) => {
+  return loggerInfoStub.getCalls()
+    .map(call => call.args[0])
+    .filter(arg => typeof arg === 'string')
+    .map((arg) => {
+      try {
+        return JSON.parse(arg)
+      } catch {
+        return null
+      }
+    })
+    .find(payload => payload?.action === action)
+}
+
+const postNewOrg = async (shortName) => {
+  return chai.request(app)
+    .post('/api/registry/org')
+    .set(secretariatHeaders)
+    .send({
+      short_name: shortName,
+      long_name: shortName,
+      authority: ['CNA'],
+      id_quota: 1000
+    })
+}
+
+const postNewUser = async (orgShortName, username) => {
+  return chai.request(app)
+    .post(`/api/registryUser/${orgShortName}`)
+    .set(secretariatHeaders)
+    .send({
+      username,
+      name: {
+        first: 'Registry',
+        last: 'User'
+      },
+      status: 'active'
+    })
+}
+
+const createRegistryUser = async () => {
+  const orgShortName = `reguser${uuidv4().replace(/-/g, '').slice(0, 12)}`
+  const username = `user_${uuidv4().replace(/-/g, '').slice(0, 12)}@example.com`
+
+  await postNewOrg(orgShortName)
+    .then((res) => {
+      expect(res).to.have.status(200)
+    })
+
+  let createdUser
+  await postNewUser(orgShortName, username)
+    .then((res) => {
+      expect(res).to.have.status(200)
+      createdUser = res.body.created
+    })
+
+  return { orgShortName, createdUser }
+}
+
 describe('Testing /registryUser endpoints', () => {
   context('Positive Tests', () => {
-    // TODO
+    it('Logs the updated user UUID when updating a registry user by identifier', async () => {
+      const { createdUser } = await createRegistryUser()
+      const loggerInfoStub = sinon.stub(logger, 'info')
+
+      try {
+        await chai.request(app)
+          .put(`/api/registryUser/${createdUser.UUID}`)
+          .set(secretariatHeaders)
+          .send({
+            UUID: createdUser.UUID,
+            username: createdUser.username,
+            name: {
+              first: 'Updated',
+              last: 'User'
+            },
+            status: 'active'
+          })
+          .then((res) => {
+            expect(res).to.have.status(200)
+            expect(res.body.updated.UUID).to.equal(createdUser.UUID)
+          })
+
+        const payload = getLoggedPayload(loggerInfoStub, 'update_registry_user')
+        expect(payload).to.not.equal(undefined)
+        expect(payload.user_UUID).to.equal(createdUser.UUID)
+      } finally {
+        loggerInfoStub.restore()
+      }
+    })
+
+    it('Logs the deleted user UUID when deleting a registry user by identifier', async () => {
+      const { createdUser } = await createRegistryUser()
+      const loggerInfoStub = sinon.stub(logger, 'info')
+
+      try {
+        await chai.request(app)
+          .delete(`/api/registryUser/${createdUser.UUID}`)
+          .set(secretariatHeaders)
+          .then((res) => {
+            expect(res).to.have.status(200)
+          })
+
+        const payload = getLoggedPayload(loggerInfoStub, 'delete_registry_user')
+        expect(payload).to.not.equal(undefined)
+        expect(payload.user_UUID).to.equal(createdUser.UUID)
+      } finally {
+        loggerInfoStub.restore()
+      }
+    })
   })
   context('Negative Tests', () => {
     it('Fails when page query parameter is not an integer', async () => {